// 1. 条件日志可以 再组合 条件命令，用来做一些变量判断，分支处理，不用执行脚本回调函数。
// 	  就是在条件命令中，先把需要判断的参数，数据保存到变量中。然后在条件日志的时候，根据这个变量来是否输出日志。
//    可以在函数入口或者出口（目标地址）附近下多个条件日志，实现对变量的 true和false的不同输出。
// 2. X64dbg 执行的时候，遇到条件断点，会先执行日志，后执行命令。命令中可以打日志，可以msg弹框，可以修改参数的值。



fn_addr = mod.main()+12410
//bp fn_addr
//bpcnd fn_addr , "0"
//bplogcondition fn_addr, "((arg.get(1)>=5))"
//bplog fn_addr, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: CreateFileW Start ...  parm1={arg.get(0)}, parm2={arg.get(1)}, parm3={arg.get(2)}, callAddr={[esp]}"



CreateFileW_Start$ = KernelBase.CreateFileW
bp CreateFileW_Start$, "CreateFileW Start"
bpcnd CreateFileW_Start$ , "0"
// 内部是双引号需要用斜杠\进行转义
bplogcondition CreateFileW_Start$, "strstr(utf16([esp+4]),\"WXWork\")"
bplog CreateFileW_Start$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: CreateFileW Start ...  filePath={utf16(arg.get(0))}, parm2={arg.get(1)}, parm3={arg.get(2)}, callAddr={[esp]}"



CreateFileW_End$ = KernelBase+118C51
bp CreateFileW_End$, "CreateFileW End"
bpcnd CreateFileW_End$ , "0"
bplogcondition CreateFileW_End$, "strstr(utf16([esp+4]),\"WXWork\")"
bplog CreateFileW_End$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: CreateFileW End ...   filePath={utf16(arg.get(0))}, parm2={arg.get(1)}, parm3={arg.get(2)},ret_hFile={eax}"
labelset CreateFileW_End$ , "CreateFileW End"



GetQueued_Start$ = KernelBase.GetQueuedCompletionStatus
bp GetQueued_Start$, "GetQueuedCompletionStatus Start"
bpcnd GetQueued_Start$ , "0"
bplogcondition GetQueued_Start$, "1"
bplog GetQueued_Start$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}:  GetQueued start ... CmpPort={[esp+4]}，pNum={[esp+8]}，lpKey={[esp+c]}，lpOlpd={[esp+10]}，dwMilliseconds={[esp+14]}，callAddr={[esp]}"



// 左侧笔记本
// GetQueued_End$ = KernelBase+14473D
// 右侧台式机
GetQueued_End$ = KernelBase+14452D
bp GetQueued_End$ , "GetQueuedCompletionStatus End"
bpcnd GetQueued_End$ , "0"
bplogcondition GetQueued_End$, "1"
bplog GetQueued_End$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}:  GetQueued End ... *pNum={[arg.get(1)]}，*pCmpKey={[arg.get(2)]}，*lpOverlapped={[arg.get(3)]}，dwMilliseconds={arg.get(4)}，retValue={eax}"
labelset GetQueued_End$ , "GetQueuedCompletionStatus End"


PostQueued_Start$ = KernelBase.PostQueuedCompletionStatus
bp PostQueued_Start$, "PostQueuedCompletionStatus Start"
bpcnd PostQueued_Start$ , "0"
bplogcondition PostQueued_Start$, "1"
bplog PostQueued_Start$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: PostQueued start ... CmpPort={arg.get(0)}，numTransfer={arg.get(1)}，dwCompletionKey={arg.get(2)}，lpOverlapped={arg.get(3)}，callAddr={[esp]}"



// 左侧笔记本
// PostQueuedCompletionStatus_End$ = KernelBase+143FB9 
// 右侧台式机
PostQueuedCompletionStatus_End$ = KernelBase+143DA9
bp PostQueuedCompletionStatus_End$, "PostQueuedCompletionStatus End"
bpcnd PostQueuedCompletionStatus_End$ , "0"
bplogcondition PostQueuedCompletionStatus_End$, "1"
bplog PostQueuedCompletionStatus_End$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: PostQueuedCompletionStatus End ... retValue={eax}"
labelset PostQueuedCompletionStatus_End$ , "PostQueuedCompletionStatus End"



CreateIoPort_Start$ = KernelBase.CreateIoCompletionPort
bp CreateIoPort_Start$, "CreateIoCompletionPort Start"
bpcnd CreateIoPort_Start$ , "0"
bplogcondition CreateIoPort_Start$, "1"
bplog CreateIoPort_Start$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: CreateIoCompletionPort start ... FileHandle={arg.get(0)}，ExistPort={arg.get(1)}，dwCmpKey={arg.get(2)}，NumOfThread={arg.get(3)}，callAddr={[esp]}"



CreateIoCompletionPort_End$ = KernelBase+144885
bp CreateIoCompletionPort_End$, "CreateIoCompletionPort End"
bpcnd CreateIoCompletionPort_End$ , "0"
bplogcondition CreateIoCompletionPort_End$, "1"
bplog CreateIoCompletionPort_End$, "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: CreateIoCompletionPort End ... retValue={eax}"
labelset CreateIoCompletionPort_End$ , "CreateIoCompletionPort End"



run 

